add Customdomain custom-domain onboarding catalog (16 templates)

[ever-just]

Description

Adds the Customdomain custom-domain onboarding catalog — 16 templates under
providerId: customdomain.ai (providerName: Customdomain, https://customdomain.ai)
covering every DNS shape a custom-domain product needs. Companion to the two already
merged: the subdomain Custom domain (#1340) and the apex Website (#1323), which
are not resubmitted here.

One template per shape, variable-driven, so a single template serves every customer. All
synchronous-flow requests are signed (syncPubKeyDomain: customdomain.ai; the public key
is published at _dck1.customdomain.ai).

Pointing (serve the domain from the Customdomain edge): apex-a (A @ → %edgeIp%),
apex-aaaa (AAAA @ → %edgeIp6%), apex-cname (APEXCNAME @), apex-www (A @ + CNAME www,
grouped), subdomain (CNAME, hostRequired), www (CNAME www), wildcard (CNAME *).
Ownership / TLS: verify (TXT @, txtConflictMatchingMode: Prefix + essential: OnApply
so re-verification updates in place), connect-verified (A @ + verify TXT, grouped —
one-step connect + prove), caa (CAA @ authorizing the edge's ACME issuer; essential: OnApply).
Email / deliverability: email-spf (SPFM), email-dkim (CNAME %selector%._domainkey),
email-dmarc (TXT _dmarc, txtConflictMatchingMode: All), email-mx (MX), email-full
(grouped MX + SPFM + DKIM + DMARC). Redirect: redirect (REDIR301).

Record types exercised: A, AAAA, APEXCNAME, CNAME, TXT, MX, SPFM, CAA, REDIR301. Every
template carries logoUrl: https://customdomain.ai/logo.svg. All 16 pass
dc-template-linter with 0 errors and validate against template.schema.

Catalog scope (deliberate deferrals)

• srv (SRV) — deferred: spec-parity shape shipped only when a concrete use case appears.
• ds (DNSSEC) — deferred: a host-API-gated capability, not a request-time DC template record.
• clickfunnels — held: a brand composite that adds no new record shape over apex-cname +
  verify + email-spf; folded into the generic catalog instead of shipped as its own template.
• email-mx uses a fixed priority: 10 (the conventional default) rather than a variable —
  the DC priority field is a numeric type, so it takes a value, not a substitution token.

Type of change

Please mark options that are relevant.

• New template
• Bug fix (non-breaking change which fixes an issue in the template)
• New feature (non-breaking change which adds functionality to the template)
• Breaking change (fix or feature that would cause existing template behavior to be not backward compatible)

How Has This Been Tested?

Please mark the following checks done

• Template functionality checked using Online Editor
• Template file name follows the pattern <providerId>.<serviceId>.json
• resource URL provided with logoUrl is actually served by a webserver

Checklist of common problems

Mark all the checkboxes after conducting the check. Comment on any point which is not fulfilled.

• syncPubKeyDomain is set on every template (published at _dck1.customdomain.ai)
• warnPhishing is not set alongside syncPubKeyDomain
• syncRedirectDomain is set whenever the template uses redirect_uri — n/a: no template uses redirect_uri (the redirect template uses a REDIR301 record, not the OAuth async param)
• no TXT record contains SPF content (v=spf1 ...) — SPF is expressed with the SPFM record type (email-spf, email-full)
• txtConflictMatchingMode is set on every TXT record that must be unique per label/content — verify/connect-verified use Prefix (customdomain-verify=); email-dmarc/email-full use All
• no variable is used as a bare full record value unless necessary — the only bare-variable values are per-customer targets that are necessarily variable: %edgeIp%/%edgeIp6% (A/AAAA), %mxHost% (MX), %dkimTarget% (DKIM CNAME), %redirectTarget% (REDIR301)
• no bare variable is used as the full host label — hosts are @, www, *, _dmarc, or %selector%._domainkey (embedded, not bare)
• no variable is used in the host field to create a subdomain — the host parameter is used (subdomain sets hostRequired)
• %host% does not appear explicitly in any host attribute
• essential is set to OnApply on records the user may need to modify without breaking the template — caa, verify, and connect-verified's verification TXT

Online Editor test results

Editor test link(s) — host + no-host per non-hostRequired template, one for the hostRequired subdomain (31 links total, each generated from the Online Editor with domain=example.com):

• apex-a — Point apex (A record) — host=www · apex (no host)
  
  applied → www A 192.0.2.10 · @ A 192.0.2.10
• apex-aaaa — Point apex (IPv6) — host=www · apex (no host)
  
  applied → www AAAA 2001:db8::10 · @ AAAA 2001:db8::10
• apex-cname — Point apex (flatten-capable hosts) — host=www · apex (no host)
  
  applied → @ APEXCNAME edge.customdomain.ai
• apex-www — Point apex + www — host=www · apex (no host)
  
  applied → www A 192.0.2.10 · www.www CNAME edge.customdomain.ai · @ A 192.0.2.10 · www CNAME edge.customdomain.ai
• subdomain — Point a subdomain — host=www
  
  applied → www CNAME edge.customdomain.ai
• www — Point www — host=www · apex (no host)
  
  applied → www.www CNAME edge.customdomain.ai · www CNAME edge.customdomain.ai
• wildcard — Point all subdomains (wildcard) — host=www · apex (no host)
  
  applied → *.www CNAME edge.customdomain.ai · * CNAME edge.customdomain.ai
• verify — Verify domain ownership — host=www · apex (no host)
  
  applied → www TXT customdomain-verify=cd-verify-1a2b3c4d · @ TXT customdomain-verify=cd-verify-1a2b3c4d
• connect-verified — Connect + verify (one step) — host=www · apex (no host)
  
  applied → www A 192.0.2.10 · www TXT customdomain-verify=cd-verify-1a2b3c4d · @ A 192.0.2.10 · @ TXT customdomain-verify=cd-verify-1a2b3c4d
• caa — Authorize SSL issuance (CAA) — host=www · apex (no host)
  
  applied → www CAA 0 issue "letsencrypt.org" · www CAA 0 issuewild "letsencrypt.org" · @ CAA 0 issue "letsencrypt.org" · @ CAA 0 issuewild "letsencrypt.org"
• email-spf — Email SPF (merge) — host=www · apex (no host)
  
  applied → www TXT v=spf1 include:spf.customdomain.ai ~all · @ TXT v=spf1 include:spf.customdomain.ai ~all
• email-dkim — Email DKIM — host=www · apex (no host)
  
  applied → cd1._domainkey.www CNAME cd1.dkim.customdomain.ai · cd1._domainkey CNAME cd1.dkim.customdomain.ai
• email-dmarc — Email DMARC — host=www · apex (no host)
  
  applied → _dmarc.www TXT v=DMARC1; p=none; rua=mailto:mailto:dmarc@example.com · _dmarc TXT v=DMARC1; p=none; rua=mailto:mailto:dmarc@example.com
• email-mx — Email MX — host=www · apex (no host)
  
  applied → www MX mx.customdomain.ai · @ MX mx.customdomain.ai
• email-full — Full email setup — host=www · apex (no host)
  
  applied → www MX mx.customdomain.ai · www TXT v=spf1 include:spf.customdomain.ai ~all · cd1._domainkey.www CNAME cd1.dkim.customdomain.ai · _dmarc.www TXT v=DMARC1; p=none; rua=mailto:mailto:dmarc@example.com · @ MX mx.customdomain.ai · @ TXT v=spf1 include:spf.customdomain.ai ~all · cd1._domainkey CNAME cd1.dkim.customdomain.ai · _dmarc TXT v=DMARC1; p=none; rua=mailto:mailto:dmarc@example.com
• redirect — Forward this domain — host=www · apex (no host)
  
  applied → www A 127.0.0.1 · www AAAA ::1 · www REDIR301 https://app.customdomain.ai · @ A 127.0.0.1 · @ AAAA ::1 · @ REDIR301 https://app.customdomain.ai

[github-actions]

✅ JSON Filename Check Passed

[github-actions]

✅ JSON Schema Validation Passed

[github-actions]

Linter OK

customdomain.ai.apex-a.json

Level	Code	Note

customdomain.ai.apex-aaaa.json

Level	Code	Note

customdomain.ai.apex-cname.json

Level	Code	Note
info	DCTL1038	APEXCNAME and REDIRxxx records are not widely supported

customdomain.ai.apex-www.json

Level	Code	Note
info	DCTL1031	all record groupId values are the same

customdomain.ai.caa.json

Level	Code	Note
info	DCTL1016	unexpeceted record type
info	DCTL1016	unexpeceted record type

customdomain.ai.connect-verified.json

Level	Code	Note
info	DCTL1031	all record groupId values are the same

customdomain.ai.email-dkim.json

Level	Code	Note

customdomain.ai.email-dmarc.json

Level	Code	Note

customdomain.ai.email-full.json

Level	Code	Note
info	DCTL1031	all record groupId values are the same

customdomain.ai.email-mx.json

Level	Code	Note

customdomain.ai.email-spf.json

Level	Code	Note

customdomain.ai.redirect.json

Level	Code	Note
info	DCTL1038	APEXCNAME and REDIRxxx records are not widely supported

customdomain.ai.subdomain.json

Level	Code	Note

customdomain.ai.verify.json

Level	Code	Note

customdomain.ai.wildcard.json

Level	Code	Note

customdomain.ai.www.json

Level	Code	Note

[github-actions]

PR Description Check Passed

All required sections are filled in correctly.

Details

  OK  Type of change: 1/4 checkboxes ticked
  OK  How Has This Been Tested?: all 3 checkboxes ticked
  OK  Checklist of common problems: 10/10 checkboxes ticked
  OK  Online Editor test results: 31 link(s) found
  OK  Template coverage: all 16 template(s) covered
Labels to remove: Checklist of common problems not complete, Forged editor links, PR description incomplete, Test links missing

PR description check PASSED

[pawel-kow]

lgtm